CleanLibrary MCP server — exposes verdict-aware supply-chain risk assessment as Model Context Protocol tools for AI agent workflows
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"cleanlib-mcp-server","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# cleanlib-mcp-server CleanLibrary MCP (Model Context Protocol) server — gives AI agents (Claude Code, Claude Desktop, Cursor, etc.) read access to CleanLibrary's library-verdict + vulnerability-intelligence APIs. Your agent can call `cleanlib_fetch_verdict` to ask *"should we use `lodash@4.17.20`?"* and get a structured response with verdict tier (`ALLOW` / `WARN` / `DENY`), CVE references, fix recommendations, and KMS-signed attestation. ## Install ```bash pip install cleanlib-mcp-server ``` Latest: **0.5.x** on PyPI. 14 tools covering verdict / advisories / exploitability / EPSS / KEV / remediation / Vector / bulk operations. ## Configure ### Claude Desktop Edit `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `%APPDATA%\Claude\claude_desktop_config.json` (Windows): ```json { "mcpServers": { "cleanlib": { "command": "cleanlib-mcp-server", "env": { "CLEANLIB_ENDPOINT": "https://cleanapp.clnstrt.dev", "CLEANLIB_API_KEY": "clk_YOUR_BEARER_HERE", "CLEANLIB_ENRICH_BEARER": "clk_YOUR_BEARER_HERE" } } } } ``` Restart Claude Desktop. The 14 tools should appear in the tool picker. ### Claude Code In your `.claude/settings.json` or via the `claude mcp add` command: ```bash claude mcp add cleanlib \ --command cleanlib-mcp-server \ --env CLEANLIB_ENDPOINT=https://cleanapp.clnstrt.dev \ --env CLEANLIB_API_KEY=clk_YOUR_BEARER_HERE \ --env CLEANLIB_ENRICH_BEARER=clk_YOUR_BEARER_HERE ``` ### Cursor / other MCP clients The server speaks standard MCP over stdio. The same `command` + `env` pattern applies — consult your client's MCP server configuration docs for the exact file location. ## Bearer provisioning CleanLibrary uses two bearer scopes: | Bearer | Scope | What it accesses | |---|---|---| | `CLEANLIB_API_KEY` | App-side (`cleanapp.clnstrt.dev`) | `cleanlib_fetch_verdict` + `cleanlib_health_check` | | `CLEANLIB_ENRICH_BEARER` | Tricorder substrate (`cleanlib-enrich.cln…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.